Live Now:
The Standards Council of Canada accredits Level 2 certification bodies, ensuring third-party assessors meet rigorous standards for evaluating contractor compliance with CPCSC requirements.
The Standards Council of Canada (SCC) plays a pivotal role in CPCSC as the official accreditation body for Level 2 certification, establishing the quality assurance infrastructure that ensures third-party assessors meet rigorous standards for evaluating contractor compliance.
Understanding the SCC's function helps executives appreciate the governance structure behind CPCSC and what to expect when pursuing Level 2 certification.
The SCC is a federal Crown corporation that reports to Parliament through the Minister of Innovation, Science and Economic Development. Established in 1970, the SCC serves as Canada's national accreditation body, coordinating the development and use of standards in Canada while providing accreditation services to demonstrate competence and credibility of organizations performing conformity assessment activities.
The SCC operates independently from government departments, maintaining the objectivity and technical credibility essential for its accreditation role. Its mandate includes promoting voluntary standardization, ensuring Canadian interests are represented in international standards development, and providing accreditation services that enable Canadian organizations to demonstrate their competence globally.
Accreditation is the formal recognition by an authoritative body that an organization is competent to perform specific activities to defined standards. In the CPCSC context, the SCC accredits certification bodies that assess defence contractors against the ITSP.10.171 standard for Level 2 compliance.
Think of it as a "certifier of certifiers"—just as Level 2 certification bodies certify that contractors meet security requirements, the SCC certifies that these certification bodies have the competence, impartiality, processes, and quality systems necessary to perform credible assessments.
This creates a chain of trust: contractors trust certification bodies to provide credible assessments, procurement officials trust certifications because they come from SCC-accredited bodies, and the overall system maintains credibility because the SCC's accreditation process is rigorous and independent.
Without formal accreditation, there would be no consistent quality assurance for Level 2 assessments. Individual certification bodies might apply different standards, use varying assessment methodologies, or lack appropriate technical competence, resulting in inconsistent certification quality where some certifications represent thorough vetting while others are rubber-stamps.
By requiring SCC accreditation for Level 2 certification bodies, CPCSC ensures all assessments meet consistent quality standards regardless of which accredited body a contractor chooses. This consistency protects both contractors (who can trust that achieving certification through any accredited body will be recognized by government) and procurement officials (who can trust that certifications represent genuine compliance regardless of which accredited body issued them).
Organizations aspiring to become Level 2 certification bodies must undergo rigorous evaluation by the SCC. The process includes the following key elements.
Organizations seeking to become certification bodies must demonstrate several key capabilities.
The government announced that the Standards Council of Canada would start accepting applications from organizations wanting to become Level 2 certification bodies beginning in 2026, with the ecosystem expected to mature through 2027. This phased approach recognizes that building a credible accreditation infrastructure takes time.
Early applicants will undergo thorough evaluation by the SCC before receiving accreditation, and initial certifications may occur more slowly as the ecosystem develops. By late 2027 and into 2028, a mature market of multiple accredited certification bodies should exist, providing contractors with choices of assessors and competitive dynamics that help control costs while maintaining quality.
Once multiple SCC-accredited certification bodies exist, contractors pursuing Level 2 will select which accredited body to engage for assessment. All accredited bodies meet the same SCC standards, but they may differ in several factors.
Importantly, contractors cannot use the same organization for both consulting to achieve compliance and formal certification assessment—this separation prevents conflicts of interest and ensures assessment objectivity. The SCC's accreditation standards include impartiality requirements addressing these potential conflicts.
The SCC is a member of international accreditation bodies including the International Laboratory Accreditation Cooperation (ILAC) and the International Accreditation Forum (IAF), which promote mutual recognition of accredited certifications across borders.
While CPCSC is a Canadian program addressing Canadian government requirements, the SCC's internationally recognized accreditation practices mean certifications from SCC-accredited bodies will have credibility with international partners. This matters for Canadian defence contractors who participate in multinational programs or supply chains where demonstrating credible cyber security assessment is important beyond just Canadian contract compliance.
The SCC itself operates under oversight and accountability mechanisms. As a Crown corporation, it reports annually to Parliament and is subject to financial and operational audits. The SCC maintains strict governance structures including a board of directors, executive leadership with relevant expertise, and documented policies and procedures for its accreditation activities.
If issues arise with SCC-accredited certification bodies—such as inadequate assessments, conflicts of interest, or quality failures—the SCC can investigate and potentially suspend or revoke accreditation. This accountability extends the quality assurance chain: contractors can report concerns about their certification body to the SCC, and procurement officials can raise questions about certifications that seem questionable, with the SCC investigating and taking corrective action if warranted.
While the SCC's accreditation services are not directly billed to contractors (certification bodies pay accreditation fees to the SCC), these costs are indirectly passed through in assessment fees contractors pay to certification bodies.
The SCC's involvement adds credibility and quality assurance but also adds cost to the overall ecosystem compared to a system without formal accreditation. The government's decision to use SCC accreditation reflects a deliberate policy choice favoring quality and consistency over minimizing costs, recognizing that the stakes involved in defending sensitive information justify investment in robust certification infrastructure.
Organizations with cyber security assessment expertise may view becoming an SCC-accredited CPCSC Level 2 certification body as a business opportunity. The defence industrial base includes thousands of contractors who will eventually need Level 2 certification, representing significant market demand for assessment services.
However, achieving and maintaining SCC accreditation requires substantial investment in personnel, processes, and quality systems. Organizations considering this path should contact the SCC directly to understand accreditation requirements, timelines, and costs before committing resources to the pursuit.
For additional information about CPCSC and the Standards Council of Canada, please consult the following resources.
Preparing for CPCSC (Canadian Program for Cyber Security Certification) demands deep knowledge of the certification framework, careful evidence preparation, and hands-on technical implementation. Plurilock delivers with compliance readiness specialists serving Canadian defense suppliers who bring proven experience guiding contractors through cybersecurity certification programs on both sides of the border.
As an established CMMC readiness provider for U.S. defense contractors, we were among the first to extend that expertise north—launching CPCSC readiness services early and serving Canadian defense suppliers from the program's earliest days. We don't conduct audits; we get you ready for them, then help you stay ready.
Why we're the superior choice:
CPCSC-ready—with proven defense contractor experience guiding every step.
A plurilock representative will contact you within one business day.
Contact Plurilock
+1 (888) 776-9234 (Plurilock)